104954777964e1f3d5c9f9cd3789cf1a5a11b0c3d852b7c00a4232d6f9c2ca16

Analysis

max time kernel
151s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 20:41

Target

104954777964e1f3d5c9f9cd3789cf1a5a11b0c3d852b7c00a4232d6f9c2ca16.exe
Size

78KB
MD5

9663666210428ddf7820efc20fbede00
SHA1

bc951e4f64835268fa25412f80470c87681becec
SHA256

104954777964e1f3d5c9f9cd3789cf1a5a11b0c3d852b7c00a4232d6f9c2ca16
SHA512

7317b22ee358f5bac4c0e0ea4d9305cda9641be24c0f9e49a186b35203beb6b1ee5295473ae240ad061fead7bde49e8a4cdf8b929cc95b2b050f6fc4e263eaf9
SSDEEP

1536:rLwBQtNcybmhZT0giGfia/LZuzLZNaKz5vNCiRdL:3wAhbcffia/LwzPZtlC

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5040 set thread context of 932	5040	104954777964e1f3d5c9f9cd3789cf1a5a11b0c3d852b7c00a4232d6f9c2ca16.exe	79

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\5zk0z0yj.job	104954777964e1f3d5c9f9cd3789cf1a5a11b0c3d852b7c00a4232d6f9c2ca16.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2676	5040	WerFault.exe	78

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5040 wrote to memory of 932	5040	104954777964e1f3d5c9f9cd3789cf1a5a11b0c3d852b7c00a4232d6f9c2ca16.exe	79
PID 5040 wrote to memory of 932	5040	104954777964e1f3d5c9f9cd3789cf1a5a11b0c3d852b7c00a4232d6f9c2ca16.exe	79
PID 5040 wrote to memory of 932	5040	104954777964e1f3d5c9f9cd3789cf1a5a11b0c3d852b7c00a4232d6f9c2ca16.exe	79
PID 5040 wrote to memory of 932	5040	104954777964e1f3d5c9f9cd3789cf1a5a11b0c3d852b7c00a4232d6f9c2ca16.exe	79
PID 5040 wrote to memory of 932	5040	104954777964e1f3d5c9f9cd3789cf1a5a11b0c3d852b7c00a4232d6f9c2ca16.exe	79

C:\Users\Admin\AppData\Local\Temp\104954777964e1f3d5c9f9cd3789cf1a5a11b0c3d852b7c00a4232d6f9c2ca16.exe
"C:\Users\Admin\AppData\Local\Temp\104954777964e1f3d5c9f9cd3789cf1a5a11b0c3d852b7c00a4232d6f9c2ca16.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Users\Admin\AppData\Local\Temp\104954777964e1f3d5c9f9cd3789cf1a5a11b0c3d852b7c00a4232d6f9c2ca16.exe
  C:\Users\Admin\AppData\Local\Temp\104954777964e1f3d5c9f9cd3789cf1a5a11b0c3d852b7c00a4232d6f9c2ca16.exe
  2⤵
  - Drops file in Windows directory
  PID:932
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5040 -s 276
  2⤵
  - Program crash
  PID:2676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5040 -ip 5040
1⤵
PID:1688

memory/932-133-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/932-134-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/932-135-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/932-136-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download